Kremlin suspected of flying drones over Europe using Russian shadow fleet

Drone intruders that possibly flew from Russian ships showed Europe isn’t ready.

Mysterious drone flights that disrupted major European airports and flew over NATO member military bases hosting US nuclear weapons may be the work of a coordinated Kremlin campaign launched from Russian-linked commercial ships.

That recent assessment from the UK-based International Institute for Strategic Studies used automatic identification system (AIS) maritime tracking data and other publicly available data to show how Russian-linked ships and “shadow fleet” vessels that transport sanctioned Russian oil were often located nearby during various drone incidents. The report suggests that the drone incidents—which impacted a dozen NATO member countries and Ireland between August 2024 and February 2026—also revealed the vulnerability of European air defenses against surveillance and harassment incursions by low-cost drones.

The IISS report identified 144 drone sightings over Europe during that time period that were unlikely to involve hobbyist recreational drones or drone activity related to the war in Ukraine. About 48 percent of the sightings took place over military bases, 26 percent happened over critical infrastructure such as ports and energy or industrial facilities, and 18 percent occurred over civilian airports. Most occurred at night or in the early morning hours before sunrise, and the drones themselves were typically described in media reports as resembling “professional” or “military-style” drones.

The think tank’s report does not claim that all drone sightings were attributable to Russian drones or were even real. But it describes the pattern of certain drone incursions as being “consistent with the Kremlin’s effort to probe allied defenses, test civilian-military response mechanisms and normalize low-level airspace violations below the threshold of an armed attack.”

The only drone incident directly attributed to Russia came in February 2026, when the Swedish military confirmed spotting and subsequently jamming a drone that took off from the Russian signals intelligence vessel Zhigulevsk in Swedish territorial waters. The Russian drone launch took place while the French aircraft carrier Charles de Gaulle and its escort ships were nearby during a visit to Sweden. But despite being the only confirmed example, the incident showed that Russian-linked ships have the capability to launch drones at sea for potential surveillance purposes.

The drone lineup

One possible drone candidate for ship-launched operations is the Merlin-VR, a fixed-wing drone developed by Russia that can be launched by a shipboard catapult system and recovered by parachute. It has the necessary flight range to enable a number of identified drone incursion incidents, while being capable of night operations and having the ability to spend time loitering over targets, according to the IISS report.

Russian companies have also developed vertical-take-off-and-landing (VTOL) drones, including the Legioner E29 Fixed-Wing Electric Drone, that require very little deck space for takeoff and landing operations. However, the IISS report suggests that homemade or commercial drones could have also been modified for a Kremlin drone campaign over Europe to prevent easy attribution to Russia.

A more common Russian drone model reported as being involved in the campaign is the Orlan-10, a fixed-wing drone with an operational range of 500 kilometers and battery endurance of up to 12 hours, along with maximum speeds between 90 kilometers per hour and 130 kilometers per hour. Such performance capabilities are “consistent with maritime launch from a vessel operating well beyond visual detection range of the European coastlines in question,” according to the IISS report.

The Orlan-10 range and payload capabilities are “consistent with stand-off collection against coastal and inland targets,” while also being able to fit within the deck space of a “mid-sized commercial vessel,” according to the IISS report. The Orlan-10 can carry payloads such as a module for spoofing signals from GPS and other global navigation satellite systems, along with a communications network monitoring module and various optical and thermal sensors.

The Orlan-10’s distinctive combustion engine noise is also consistent with the accounts of people who witnessed drone incursions that took place near RAF Lakenheath in the UK between November 20 and November 26 in 2024.

Drone sightings and lurking ships

The mystery drone incursions in November 2024 occurred at RAF Lakenheath and several other Royal Air Force stations—including RAF Fairford, RAF Feltwell, and RAF Mildenhall—that represent the home bases for thousands of US Air Force personnel and dozens of US military aircraft.

As the largest US military base in the UK, RAF Lakenheath is also set to receive more than $1.6 billion in upgrades that include facilities for housing a nuclear arsenal, The Guardian reported on June 30, 2026.

The drone incidents over the UK military bases in November 2024 occurred when the cargo ship Hav Dolphin, flagged in Antigua and Barbuda but operating with a Russian crew, was docked in the UK. The same Hav Dolphin ship was later separately investigated by German authorities after it anchored offshore near the German city of Kiel in May 2025, which coincided with drone sightings at a German submarine base at Eckernförde just northwest of Kiel on the Baltic Sea coast.

The incidents in the UK coincided with other drone sightings over sensitive military sites in November 2024. For example, drones repeatedly entered the airspace over Kleine-Brogel Air Base in Belgium for three consecutive nights in early November, while other drone sightings occurred over a military facility in Leopoldsburg. The Kleine-Brogel Air Base houses US nuclear weapons that could be deployed by allied aircraft under NATO’s nuclear-sharing arrangement.

Meanwhile, drones were spotted over Ramstein Air Base in Germany on November 26, 2024, which represents the headquarters for both NATO Allied Air Command and the US Air Forces in Europe and Air Forces in Africa. Such mystery drone flights over Ramstein continued through early 2025.

Drones also targeted the Volkel Air Base in the Netherlands for three separate days in November and December 2025. That base houses military aircraft capable of being armed with US nuclear bombs under the NATO nuclear-sharing agreement.

The biggest drone incursion at Volkel occurred during the evening of November 21, 2025, a “highly coordinated flight” of up to 10 drones was spotted over Volkel and evaded capture or destruction despite base security attempts to shoot them down. That coincided with drone sightings over Eindhoven Airport that forced authorities to briefly shut down civil air traffic across the southern Netherlands.

Those drone incursions over the Netherlands coincided with “multiple suspicious vessels,” including the shadow fleet ships Arctica, Cgas Leopard, Tranquil Sea, and Eagle S, loitering in international waters or at anchorages near the Dutch and French coasts. The Eagle S oil tanker had been previously investigated for severing undersea cables in the Baltic Sea on Christmas Day in 2024, although a Finnish court dismissed the case after ruling that it lacked jurisdiction over the matter.

In early December 2025, five drones were detected over the Île Longue base in Brittany, France, which houses French nuclear ballistic missile submarines and the stockpile of their nuclear weapons. By chance, the suspect ships Hav Dolphin and Arctica (the latter operating under a different name at the time) were also located within 350 and 370 kilometers of the base at the time, while three other shadow fleet ships were even closer.

A prime shadow fleet suspect

One of the most intriguing ship suspects linked to various drone incidents is the oil tanker Boracay. That ship became the focus of a Danish investigation after drone sightings in September 2025 disrupted air traffic operations at airports all across Denmark and even forced the temporary closure of Copenhagen Airport along with the Aalborg Royal Danish Air Force base.

Danish authorities did not specifically name Russia as the main culprit behind the drone incursions but described the possibility of drones launching from ships. Much of their investigation focused on the Boracay shadow fleet vessel that was located off the Danish coast during the incidents.

On September 28, 2025, French naval commandos made additional discoveries after boarding the Boracay off the French coast—possibly because of the ship’s suspected link to the drone incidents over Denmark. The French commandos found that the ship had a Chinese captain but also happened to be carrying two Russians employed by the Moran Security Group, a Russian private military company founded by former Federal Security Service officers. One of the Russians also previously worked for Russia’s Wagner Group private military company.

Interviews revealed that the Russians were charged with “gathering intelligence, protecting the vessel and ensuring the captain strictly adhered to Russian interests.” That provided “direct evidence of a shadow-fleet vessel linked to Russian intelligence structures,” according to the IISS report.

On March 30, 2026, a French court sentenced the Chinese captain in absentia to one year in prison and issued an arrest warrant after convicting him of failing to comply with orders to stop his ship. The court also ordered the captain to pay a $172,000 fine.

The European response

The full report goes into much more detail about the movements of individual shadow fleet vessels during various drone incidents. But the overall picture of the possible Russian drone campaign suggests that the European response has been fragmented and uncoordinated for the most part so far.

The European Union is working to develop a European Drone Defence Initiative (EDDI) that would enable member countries to deploy interoperable counter-drone technologies for detecting, tracking, and shooting down or otherwise neutralizing drones. But the system is not expected to be fully functional until the end of 2027.

The IISS report also warns that “no amount of hardware will compensate for the absence of political authority to use it,” and suggests that European governments need to better coordinate to establish legal clarity around rules of engagement for drone incursions.

Then there is the “hardest” problem of maritime accountability, according to the IISS report. That will require European governments to be more willing to investigate and stop Russian-linked ships and shadow fleet vessels from loitering near European coasts while launching drones with “effective impunity.”